sounds strange<br><br>If it was my connection, I would fire up a network sniffer and see what's in those requests.<br>If it continues and you don't feel comfortable with it, filter out that IP on your firewall.<br>
<br>If you do see something unusual in those request, could you be so kind to post a dump file (pcap format) of the traffic (filtered by that IP of course) so the rest of us can take a look? :)<br><br><br><br><div><span class="gmail_quote">
On 8/31/07, <b class="gmail_sendername">Scott Bennett</b> <<a href="mailto:bennett@cs.niu.edu">bennett@cs.niu.edu</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Using netstat or lsof, there are sometimes over 50 ESTABLISHED connections<br>to my tor server's DirPort from a single IP source address, which resolves to<br><br> <a href="http://ignfwdnoi-nat.asia.csc.com">
ignfwdnoi-nat.asia.csc.com</a><br><br>Each such connection is usually displayed by netstat to have at least 32500<br>bytes in the send queue.<br> I've checked the current cached-routers and cached-routers.new files and
<br>have found no sign of either <a href="http://ignfwdnoi-nat.asia.csc.com">ignfwdnoi-nat.asia.csc.com</a> or its IP address<br>(<a href="http://20.139.66.64">20.139.66.64</a>) in either file, so it doesn't appear to be a valid exit server,
<br>from which directory fetch requests might be appearing.<br> Does anyone have an idea what might be going on? I.e., is it something<br>legitimate? Or should I treat it as an attack of some sort and respond by<br>
blocking packets from that system at my router?<br><br><br> Scott Bennett, Comm. ASMELG, CFIAG<br>**********************************************************************<br>* Internet: bennett at
<a href="http://cs.niu.edu">cs.niu.edu</a> *<br>*--------------------------------------------------------------------*<br>* "A well regulated and disciplined militia, is at all times a good *
<br>* objection to the introduction of that bane of all free governments *<br>* -- a standing army." *<br>* -- Gov. John Hancock, New York Journal, 28 January 1790 *
<br>**********************************************************************<br></blockquote></div><br>